Readiness Heat Map · MA Plans

Four FHIR APIs. Four ways to build them. Only some scale.

CMS-0057-F mandates four interoperability APIs with most mid-size plans still mid-vendor-selection. Here's what scaled — and what stalled — at peer plans this cycle.

days to the Jan 1, 2027 compliance deadline
Mar 31
public PA-metrics filing due every year — searchable by CMS
3/7
mid-size plans hit Q1 2026 milestones on time
3 IGs
PAS + CRD + DTR converge in the Prior Auth API alone

The heat map — tap any cell

Four required APIs × four implementation patterns. Read for what scaled vs. what typically stalls.

Vendor
turnkey
Vendor
composable
In-house
build
Hybrid
Recommended Conditional High risk / typically stalls

What scaled vs. what stalled

Drawn from publicly announced CMS-0057-F vendor selections, Jan–May 2026.

Scaled

On-time at Q1 2026 milestones
  • Treated CMS-0057-F as a program, not a project — one accountable exec across IT, UM, and network.
  • Chose composable vendors for PA (Edifecs, Availity, MCG-integrated) and kept the rules engine in-house where UM nuance lived.
  • Started PA-metrics instrumentation in Q3 2025 — so the March 31 filing was a query, not a fire drill.

Stalled

Mid-scope and behind schedule
  • Picked turnkey PA vendors, then found the PAS-CRD-DTR coupling didn't match LOB-specific clinical criteria — now mid-rebuild.
  • Built Patient Access in-house — easy on paper, became a 9-month identity / auth / consent project.
  • Treated vendor selection as a procurement decision, not an architecture decision — signed before any technical review.

The three decisions that compound

Baked in early, expensive to reverse. These set your trajectory through 2027.

Where does the PAS rules engine live?

Vendor-owned = fast launch, slow customization. In-house = slow launch, fast customization. There is no middle path that doesn't add latency.

How does Provider Access handle attribution edge cases?

Multi-payer members, mid-quarter assignment changes, network changes — your attribution math survives all three or your "real-time" API returns stale data.

What's your audit-defense story for PA decisions?

The CY2025 PA-metrics filing is publicly searchable. A slow decision time on day 1 of 2027 starts a CMS investigation cycle by day 90.

Mid-decision on any of these patterns?

I run fractional CTO engagements with mid-size MA plans (200K–2M members) on CMS-0057-F vendor selection, architecture review, and program-level delivery oversight — embedded as your technical leader through the deadline. Most engagements run 3–6 months at $30–45K/month.